Recipe 20.14. Setting Up and Using Dr. Watson to Troubleshoot Errors

Problem

You want to get more detailed logs on application and driver errors to determine possible causes.

Solution

Run Dr. Watson

Go to Start, select Run, type in drwtsn32.exe, and click OK.

Enhance the debug information available to Dr. Watson

Open My Computer and navigate to the %systemroot% folder (usually C:\WINDOWS) on your computer.
Select File, then New, and create a new folder named Symbols.
Insert your Windows XP CD-ROM.
Open My Computer and navigate to the Support\Debug\i386 folder on the Windows XP CD-ROM.
Copy the symbols to the Symbols folder that you created on your computer in Step 2.
Right-click My Computer, and then select Properties.
Select the Advanced tab, and then click the Environment Variables button.
Click New under System variables.
Type _NT_SYMBOL_PATH for the Variable name, then %systemroot%\Symbol for the Variable value.
You can add symbols for hot fixes, patches and service packs by including additional variables for example, the Variable value could read:
```
%systemroot%\symbol;%systemroot%\hotfixes;%systemroot%\symbolsSp2
```
if you've copied symbols from the different patches to these folders.
Click OK to close the dialogs.

Discussion

Unless you've installed another debugger application to handle programs errors and exceptions, Microsoft's Dr. Watson logs the error data for you. By default, Dr. Watson tracks only 10 instructions and 10 errors, and collects a mini-dump log file of the system state at the time of the error. The Dr. Watson dialog allows you to configure logging of more instructions and errors, a more verbose log, and log program symbol tables if they are available.

Excerpts from a C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\drwtsn32.log file below show you just how much information can be collected about a single error event:

Microsoft (R) DrWtsn32 Copyright (C) 1985-2001 Microsoft Corp. All rights reserved. Application exception occurred:         App: F:\Program Files\Thumbs7\Thumbs.exe (pid=1156)         When: 6/30/2004 @ 06:09:52.593         Exception number: c0000005 (access violation) *----> System Information <----*         Computer Name: SIRAH         User Name:          Terminal Session Id: 0         Number of Processors: 1         Processor Type: x86 Family 6 Model 10 Stepping 0         Windows Version: 5.1         Current Build: 2600         Service Pack: 1         Current Type: Uniprocessor Free         Registered Organization:          Registered Owner:  *----> Task List <----*    0 System Process    4 System    ... *----> Module List <----* (0000000000330000 - 0000000000362000: C:\WINDOWS\System32\ODBC32.dll (0000000000400000 - 0000000000f94000: F:\Program Files\Thumbs7\Thumbs.exe  ... *----> State Dump for Thread Id 0x230 <----* eax=00000038 ebx=00000000 ecx=0012f5c4 edx=eed33d64 esi=00390608 edi=00000000 eip=7ffe0304 esp=0012f2cc ebp=0012f354 iopl=0         nv up ei pl nz na pe nc cs=001b  ss=0023  ds=dbc8  es=1f80  fs=0038  gs=0038             efl=00000202 function: <nosymbols>         7ffe02f2 0000             add     [eax],al         7ffe02f4 0000             add     [eax],al         7ffe02f6 0000             add     [eax],al *----> Stack Back Trace <----* *** ERROR: Symbol file could not be found.  Defaulted to export symbols for  C:\WINDOWS\System32\ntdll.dll -  WARNING: Stack unwind information not available. Following frames may be  wrong. *** ERROR: Symbol file could not be found.  Defaulted to export symbols for  C:\WINDOWS\system32\msvcrt.dll -  *----> Raw Stack Dump <----* 000000000012f2cc  34 c5 f5 77 68 9f f6 77 - 70 03 00 00 00 00 00 00  000000000012f2dc  00 00 00 00 00 00 39 00 - d0 c3 39 00 00 00 00 00

The actual log file goes on for several hundred lines, indicating minute details for each and every running process. Dr. Watson logs are most useful to programmers who have access to symbols tables for their specific programs, and who understand the sequences of instructions that are related to the application. The log file output may make some sense to nonprogrammers by telling you which program caused an error, potentially conflicting applications, and related error codes which may help you search for solutions in a program vendor's web site or the Web in general. Occasionally an application vendor may ask you to send the log file to their technical support department for further analysis.